CVE-2025-59476

Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not restrict or transform the characters that can be inserted from user-specified content in log messages, allowing attackers able to control log message contents to insert line break characters, followed by forged log messages that may...

SUSE-SU-2025:01952-1 Security update for python-Django

This update for python-Django fixes the following issues: - CVE-2025-48432: log injection or forgery due to unescaped control characters being added into logs bsc1244095...

GHSA-7XR5-9HCQ-CHF9 Django Improper Output Neutralization for Logs vulnerability

An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are...

PYSEC-2025-47

An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are...

DEBIAN-CVE-2025-48432

An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are...

PYSEC-2025-47

An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are...

Django 安全漏洞

Django is a set of open source web application frameworks based on the Python language from the Django Foundation. The framework includes an object-oriented mapper, view system, template system, and more. A security vulnerability exists in Django versions prior to 5.2.2, prior to 5.1.10, and prio...

UBUNTU-CVE-2025-48432

An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are...

CVE-2020-6227

SAP Business Objects Business Intelligence Platform CMS / Auditing issues, version 4.2, allows attacker to send specially crafted GIOP packets to several services due to Improper Input Validation, allowing to forge additional entries in GLF log files...

CVE-2024-31845

An issue was discovered in Italtel Embrace 1.6.4. The product does not neutralize or incorrectly neutralizes output that is written to logs. The web application writes logs using a GET query string parameter. This parameter can be modified by an attacker, so that every action he performs is...

CVE-2023-46713

An improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5 and 7.4.0 may allow an attacker to forge traffic logs via a crafted URL of the web application...

Input validation

An improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5 and 7.4.0 may allow an attacker to forge traffic logs via a crafted URL of the web application...

PT-2023-7754 · Fortinet · Fortiweb

Name of the Vulnerable Software and Affected Versions: Fortinet FortiWeb versions 6.2.0 through 6.2.8 Fortinet FortiWeb versions 6.3.0 through 6.3.23 Fortinet FortiWeb versions 7.0.0 through 7.0.9 Fortinet FortiWeb versions 7.2.0 through 7.2.5 Fortinet FortiWeb version 7.4.0 Description: The issu...

YugabyteDB Cross-Site Scripting Vulnerability

YugabyteDB is a high-performance transactional distributed SQL database for cloud-native applications from Yugabyte, Inc. YugabyteDB suffers from a cross-site scripting vulnerability that stems from the ease of injecting cross-site scripting via logs, where writing invalid user input to a log fil...

Cognex 3D-A1000 Dimensioning System 安全漏洞

The Cognex 3D-A1000 Dimensioning System is a compact industrial smart camera capable of capturing moving objects in 3D and 2D from Cognex Corporation. A security vulnerability exists in Cognex 3D-A1000 Dimensioning System version 1.0.3 3354 and prior versions, which is caused by invalid log outpu...

Apache Superset Code Injection Vulnerability

A code injection vulnerability exists in Apache Superset, a data visualization and data exploration platform from the Apache Foundation, prior to version 1.3.2, which stems from a web-based system or product that does not properly authenticate incoming data. An authenticated attacker could exploi...

Unspecified Vulnerability in SAP Business Objects Business Intelligence Platform

SAP Business Objects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The product features report generation, analytics, and data visualization. A security vulnerability exists in SAP Business Objects Business...

UBUNTU-CVE-2018-18838

An issue was discovered in Netdata 1.10.0. Log Injection or Log Forgery exists via a %0a sequence in the url parameter to api/v1/registry...

CVE-2018-18838

CVE-2018-18838 affects Netdata 1.10.0 and is a log injection vulnerability reachable via a %0a sequence in the url parameter to api/v1/registry. The CVSS:3.0 base is 7.5 (HIGH) with network access and no authentication; integrity impact is HIGH, confidentiality/availability are none. Public advis...

SAP HANA DB Log Entry Forgery Vulnerability

SAP HANA DB is an in-memory database based on rows and columns. A security vulnerability in the grant.xsfunc application in the testApps/grantAccess/ URI in the SAP HANA DBXS Engine allows remote attackers to send specially crafted requests to forge logs...